| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizerCVE-2025-6638 · GHSA-59P9-H35M-WG4GVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Transformers is vulnerable to ReDoS attack through its DonutProcessor classCVE-2025-3933 · GHSA-37MW-44QP-F5JMVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Logrus is vulnerable to DoS when using Entry.Writer()CVE-2025-65637 · GHSA-4F99-4Q7P-P3GHVersion ranges need review. |
github.com/sirupsen/logrusConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Hugging Face Transformers library has Regular Expression Denial of ServiceCVE-2025-6051 · GHSA-RCV9-QM8P-9P6JVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizerCVE-2025-6921 · GHSA-4W7R-H757-3R74Version ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197 · GHSA-9356-575X-2W9MVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Transformers's Improper Input Validation vulnerability can be exploited through username injectionCVE-2025-3777 · GHSA-PHHR-52QP-3MJ4Version ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| Starlette has possible denial-of-service vector when parsing large files in multipart formsCVE-2025-54121 · GHSA-2C2J-9GV5-CJ73Version ranges need review. |
starletteOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q |
on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Non-linear parsing of case-insensitive content in golang.org/x/net/htmlCVE-2024-45338 · GHSA-W32M-9786-JP63 |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
High
|
Fix reported |
|
| Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situationsCVE-2024-51744 · GHSA-29WX-VH33-7X7RVersion ranges need review. |
github.com/golang-jwt/jwt/v4Builds for Red Hat OpenShift/openshift-builds-triggers-container |
GoRed Hat |
Low
|
Fix reported |
|
| Infinite parsing loop in golang.org/x/netCVE-2025-58190 · GO-2026-4441 |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Sensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336 · GO-2025-3420 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| prettier: prettier parseNestedCSS ReDoSCVE-2025-8263 |
Cryostat 4/io.cryostat-cryostatMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
